T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cooplens_core.py:837- Finding
Unrestricted Report-Supplied URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
tuple[bool, str, str]: try: req = urllib.request.Request(url, headers={"User-Agent": "CoopLens critical-source evidence check"}) with urllib.request.urlopen(req, timeout=timeout) as resp: status = int(getattr(resp, "status", None) or resp.getcode()) ctype = (resp.headers.get("content-type") or "").lower() data = resp.read(max_bytes) if status < 200 or status >= 400: return False, "", f"status {status}" if any(t in ctype for t in ["zip", "rar", "7z", "octet-stream"]): return False, "", f"not inspectable text/html source: {ctype}" text = data.decode("utf-8", errors="ignore") text = re.sub(r"|", " ", text, flags=re.I) text = re.sub(r"<[^>]+>", " ", text) text = html.unescape(re.sub(r"\s+", " ", text)) if not text.strip(): return False, "", f"empty or non-text source: {ctype}" return True, text, "" except Exception as exc: return False, "", str(exc)[:200] ``` ```python def cmd_link_check(args: argparse.Namespace) -> int: text = read_text(Path(args.report)) urls = list(dict.fromkeys(URL_PATTERN.findall(text)))[: args.max_urls] results = [] errors = [] for url in urls: try: req = urllib.request.Request(url, headers={"User-Agent": "CoopLens local link check"}) with urllib.request.urlopen(req, timeout=args.timeout) as resp: status = getattr(resp, "status", None) or resp.getcode() ctype = resp.headers.get("content-type", "") resul ...[truncated 4424 chars]- Remediation
View remediation